Control system

ABSTRACT

A control apparatus  50  for a gas turbine engine for an aircraft includes engine control means  52  forming part of an outer fuel control loop and fuel control means/overthrust protector  76  forming part of an inner fuel control loop. Overthrust protection is provided within each of the engine control means  52  and the fuel control means/overthrust protector  76 , which are powered and housed separately. Thus, a failure within one of these systems could not result in overthrust and demonstrably reliable overthrust protection is provided within a single channel.

[0001] The invention relates to a control apparatus for protectingagainst overthrust in an engine for an aircraft.

[0002] Overthrust is a condition in which an aircraft engine producesexcessive thrust which cannot be alleviated by movement of the throttle.The condition can occur in respect of thrust level or thrust direction(where the engine produces forward thrust even though the thrustreversers have been commanded to deploy but have failed).

[0003] Overthrust is a condition at the engine level that leads to anevent at the aircraft level which is defined as catastrophic. This meansthat new control systems are obliged to be designed such that a singlephysical or functional failure cannot result in overthrust and such thatthere is an extremely remote likelihood of the occurrence of overthrustdue to multiple failures.

[0004] In a typical dual channel control system, it is difficult todemonstrate satisfactorily that a single failure could not produceoverthrust. This is primarily due to the lack of adequate independencebetween control of thrust and protection against overthrust.

[0005] In view of the above, an aircraft cannot safely operate on asingle channel because it is necessary that each channel effectivelycover for any faults in the other channel.

[0006] In a single channel control system, it is not possible todemonstrate that a single failure could not produce overthrust.

[0007] According to the invention there is provided a control apparatusfor an aircraft engine, the control apparatus including:

[0008] engine control means including:

[0009] means for receiving a signal representative of a desired thrustfor the engine;

[0010] means for receiving a signal representative of the actual thrustof the engine; and

[0011] means for analysing the above signals and for producing a signalrepresentative of a desired fuel flow for the engine; and

[0012] fuel control means including:

[0013] means for receiving a signal representing a desired fuel flow;

[0014] means for providing a signal to a fuel monitoring means forregulating the flow of fuel to the engine;

[0015] means for receiving a feedback signal from the fuel monitoringmeans; and

[0016] means for analysing the signal representing desired fuel flow andthe feedback signal from the fuel monitoring means and adjusting thesignal to the fuel monitoring means, for achieving the desired fuelflow;

[0017] wherein the engine control means and the fuel control means areseparately powered such that a failure of the power supply to one ofthem will not necessarily result in a failure of the power supply to theother.

[0018] Preferably the engine control means and the fuel control meansare also physically separated. The physical separation may take the formof a physical barrier such as a metal plate. The engine control meansand the fuel control means may be provided within separate housingsallowing limited communication of data therebetween.

[0019] The control apparatus may further include selection means forreceiving first and second signals each representating a desired fuelflow and selecting the lower of the two. The fuel control means mayreceive the selected lower desired fuel flow signal.

[0020] The first signal representing desired fuel flow may be producedby the engine control means.

[0021] The second signal representing desired fuel flow may be producedby a protector means. The protector means is preferably poweredseparately from the engine control means. The protector means preferablyincludes means for receiving a signal representing engine thrust, whichmay comprise a single representing engine speed, and a signal indicatingwhether a throttle of the engine is at idle or in reverse and the thrustreversers not deployed. The protector means preferably further includesmeans for calculating a maximum desired fuel flow demand appropriate forthe above conditions.

[0022] The signal representing desired thrust, received by the enginecontroller, may be a signal indicating a desired engine speed, forexample a desired low pressure shaft speed. Alternatively, the signalmay be a pressure signal and/or a temperature signal.

[0023] The signal representing actual thrust, received by the enginecontroller, may be indicative of engine speed, for example low pressureshaft speed, or of pressure and/or temperature within the gas turbineengine.

[0024] The engine control means may include means for determiningwhether the comparative values of the signals representing actual thrustof the engine and the desired thrust of the engine suggest overthrust,possibly caused by failure of the fuel control means. Preferably theengine control means includes means for reducing or preventing fuel flowto the engine in such circumstances. These means may include means forclosing a shut-off valve. The engine control means may electricallydrive the shut-off valve.

[0025] The control apparatus may further include fuel monitoring means,which may comprise a fuel metering valve, the position of which may becontrolled by the signal from the fuel control means. The protectormeans may electrically drive the fuel metering valve. The fuel meteringvalve may be adjusted by a torque motor. The control apparatus mayfurther include means for monitoring the position of the fuel meteringvalve. These means may include a linear variable differentialtransformer, which may produce a feedback signal representative of theposition of the fuel metering valve. This feedback signal may be thefeedback signal received by the fuel control means.

[0026] The fuel metering valve position preferably controls the fuelflow to the engine, thereby controlling the thrust of the engine.

[0027] According to the invention there is further provided an aircraftincluding a control apparatus as defined in any of the preceding tenparagraphs.

[0028] An embodiment of the invention will be described for the purposeof illustration only with reference to the accompanying drawings inwhich:—

[0029]FIG. 1 is a diagrammatic cross-section through a gas turbineengine suitable for control by a system according to the invention;

[0030]FIG. 2 is a block diagram representating a single channel, priorart control system;

[0031]FIG. 3 is a highly simplified block diagram representating asingle channel control system according to the invention; and

[0032]FIG. 4 is a block diagram representating a single channel controlsystem according to the invention, illustrating the interaction betweenthe inner and outer fuel flow control loops and engine thrust in detailbut omitting the interaction between the engine controller and the shutoff valve.

[0033] With reference to FIG. 1 a ducted fan gas turbine enginegenerally indicated at 10 comprises, in axial flow series, an air intake12, a propulsive fan 14, an intermediate pressure compressor 16, a highpressure compressor 18, combustion equipment 20, a high pressure turbine22, an intermediate pressure turbine 24, a low pressure turbine 26 andan exhaust nozzle 28.

[0034] The gas turbine engine 10 works in the conventional manner sothat air entering the intake 12 is accelerated by the fan 14 to producetwo air flows, a first air flow into the intermediate pressurecompressor 16 and a second airflow which provides propulsive thrust. Theintermediate pressure compressor 16 compresses the air flow directedinto it before delivering the air to the high pressure compressor 18where further compression takes place.

[0035] The compressed air exhausted from the high pressure compressor 18is directed into the combustion equipment 20 where it is mixed with fueland the mixture combusted. The resultant hot combustion products thenexpand through and thereby drive the high, intermediate and low pressureturbines 22, 24 and 26 before being exhausted through the nozzle 28 toprovide additional propulsive thrust. The high, intermediate and lowpressure turbines 22, 24 and 26 respectively drive the high andintermediate pressure compressors 16 and 18 and the fan 14 by suitableinterconnecting shafts.

[0036] The thrust produced by the engine is controlled by adjusting theflow of fuel to burners (not illustrated) of the combustion equipment20. FIG. 2 illustrates a known engine control system 50, includingengine control means 52 and fuel control means 54.

[0037] Referring to FIG. 2 the engine controller 52 has inputs includinga throttle position 56 and air data and rating 58. These are the basicinputs which enable the engine controller to determine the fuel flowrequired by the engine. The engine controller also includes a throttleat idle input 60, this being a simple on/off signal indicating whetheror not the throttle is at idle, and a low pressure shaft speed signal62. The function of these signals will be described below.

[0038] The fuel controller 54 includes a fuel metering valve (“FMV”)which is able to control the amount of fuel being passed to the burnersof the aircraft engine combustor. The fuel controller also includes ashut-off valve (“SOV”) 66, being a simple on/off valve which is openduring operation but which is moved into the closed position at the endof a flight or, for example, in the event of a malfunction of the fuelmetering valve.

[0039] Various signals pass between the engine controller and the fuelcontroller. These include an FMV demand signal 68 and an FMV feedbacksignal 70. In addition an SOV demand signal 72 and an SOV feedbacksignal 74 pass between the engine controller and the shut-off valve.

[0040] In operation, the engine controller 52 analyses the throttleposition and the air data and rating to determine the rate of fuelrequired by the engine. The engine controller produces a resulting FMVdemand signal 68 which passes to the fuel metering valve 64 within thefuel controller 54. The fuel metering valve is moved to an appropriateposition for this rate of fuel and the fuel is then supplied to theburners, via the shut-off valve 66 which is open in operation. The FMVfeedback signal is continually monitored by the engine controller andthe FMV demand signal adjusted accordingly.

[0041] The control system 50 has certain adaptations to protect againstoverthrust. As described previously, overthrust is a condition in whichthe engine produces excessive thrust which cannot be alleviated bymovement of the throttle. The engine controller checks the low pressureshaft speed signal 62 and the throttle at idle signal 60. If thethrottle is at idle, the low pressure shaft speed should respond to thethrottle and should be reducing or below a threshold and not increasingand above a threshold. The threshold is idle plus a margin. If the lowpressure shaft speed is not reducing, this indicates an overthrustsituation and the engine controller therefore sends a signal along line72 demanding the shut-off valve to move into the closed position. Thisstops fuel flowing to the burners.

[0042] It may be seen that in the above system, the engine controller 52provides the FMV demand signal 68 and also the SOV demand signal 72.Therefore an error in the engine controller which resulted in overthrustcould theoretically also result in the engine controller not providingthe SOV demand signal correctly. Thus, it cannot be demonstrated that asingle failure in the above system, for example in the power supply tothe engine controller, could not cause an overthrust situation.

[0043]FIGS. 3 and 4 illustrate a control system 50 according to theinvention, FIG. 3 providing abroad overview and FIG. 4 being moredetailed but omitting the interaction between the engine controller andthe fuel controller sov. Referring initially to FIG. 3, it may be seenthat the engine controller 52 is provided with control system inputs 58,a low pressure shaft speed signal 62 and a throttle position signal 56.The engine controller 52 may be regarded as forming part of an outerfuel control loop.

[0044] An overthrust protector 76 includes a throttle at idle input 60and a low pressure shaft speed signal 63. The low pressure shaft speedsignal 63 for the overthrust protector is independent of the lowpressure shaft speed signal 62 of the engine controller. The overthrustprotector 76 may be regarded as forming part of an inner fuel controlloop. The inner fuel control loop includes an FMV demand signal 68,passing between the overthrust protector 76 and a fuel metering valve64, and an FMV feedback signal 70 passing from the fuel metering valve64 to the overthrust protector 76.

[0045] The fuel metering valve 64 is provided within fuel control means54, which also includes a shut-off valve 66. The shut-off valve iscontrolled from the engine controller 52 via an SOV demand signal 72.

[0046] In operation, the engine controller 52 monitors the throttleposition signal 56 and the low pressure shaft speed signal 62, togetherwith the control system inputs 58, to provide a signal 78 representativeof the fuel flow required by the engine. This signal passes to theoverthrust protector 76. In normal operation, the fuel flow demandsignal 78 is translated by the overthrust protector 76 into an FMVdemand signal 68. However, the overthrust protector 76 also monitors thethrottle at idle signal 60 and its low pressure shaft speed signal 63.If the throttle is at idle, the low pressure shaft speed should bedecreasing or below a threshold, as mentioned previously. If this is notthe case, the overthrust protector detects an overthrust situation andoverrides the fuel flow demanded by the engine controller. In this casethe overthrust protector 76 provides an FMV demand signal in line with areasonable demand based on the low pressure shaft speed and throttle atidle signal.

[0047] Should there be a failure in the overthrust protector 76,resulting in overthrust, the engine controller 52 will detect this bymonitoring the low pressure shaft speed signal 62 and the throttleposition signal 56. If the throttle is at idle, the low pressure shaftspeed should be decreasing or below a threshold and, if this is not thecase, the engine controller is able to detect overthrust and send asignal down line 72 to operate the shut-off valve. This thereforeprevents fuel from flowing to the burners.

[0048]FIG. 4 illustrates part of the above system in somewhat moredetail. It may be seen that the engine controller 52 is provided with aspeed or pressure demand signal 80 resulting from a thrust demand,represented by the arrow 82. This is generally equivalent to thethrottle position signal 56 in FIG. 3. The engine controller 52 alsoreceives a speed or pressure voltage signal 84 which it converts into aspeed or pressure feedback signal 86. The speed or pressure voltagesignal is derived from a speed or pressure sensor 88 provided within theaircraft engine.

[0049] The engine controller uses the speed or pressure demand signal 80and the speed or pressure feedback signal 86 to calculate a fuel flowdemand, which is output as a first fuel flow demand signal 78.

[0050] The first fuel flow demand signal 78 is input into a comparitor92 within the overthrust protector 76. The comparitor 92 is alsoprovided with a second fuel flow demand signal 94 indicative of a fuelflow limit. The second fuel flow demand signal 94 is provided by theoverthrust protector. The overthrust protector includes a throttle atidle signal 96, a speed at idle signal 98 and a speed at red line signal100. In addition, a speed feedback signal 102 is provided, thisresulting from a speed signal voltage 104 in turn derived from a speedsensor 106 provided within the engine. The overthrust protector is ableto compare these various signals to provide a maximum fuel flow demandwhich the engine controller should be requesting for these conditions.This is the fuel flow demand signal 94.

[0051] The comparitor 92 chooses the lower one of the two fuel flowdemand signals 78 and 94. Therefore, provided that the fuel flow demandsignal 78 (produced by the engine controller 52) is below the perceivedmaximum fuel flow demand signal 90 (as calculated by the overthrustprotector 76), the fuel flow demand signal 78 is chosen by thecomparitor. The fuel flow demand signal 78 is then used by theoverthrust protector to determine an FMV demand signal 68. The FMVdemand signal 68 is compared with an FMV position feedback signal 74 anFMV position error which is used to control a drive current for a fuelmetering valve torque motor 108. The torque motor 108 drives the fuelmetering valve 64 into a desired position. A fuel metering valve linearvariable differential transformer 110 converts the position of the fuelmetering valve into a voltage signal 112 which is used to derive the FMVfeedback signal 74. This provides a closed loop control for the fuelmetering valve position.

[0052] The position of the fuel metering valve 64 dictates the fuel flowto the burners of the combustion equipment (indicated by 114) andthereby controls the thrust of the aircraft engine. The thrust in turnaffects the speed or pressure sensor 88 and the speed sensor 106.

[0053] It will be appreciated that if the engine controller 52malfunctions and demands too high a fuel flow along the fuel flow demandsignal line 78, this will be overridden by the fuel flow demand signal94 (which represents a fuel flow limit) if appropriate. In this way,overthrust protection is built into this system.

[0054] Should the overthrust protector 76 malfunction, the enginecontroller 52 is able to detect this by monitoring the low pressureshaft speed and the signals representative of demanded thrust. If thesesignals indicate an overthrust situation, the engine controller sends asignal to the shut-off valve 66 (not illustrated in FIG. 4) in order tostop fuel passing to the burners.

[0055] The circuitry making up the engine controller 52 is powered by aseparate power supply to the circuitry making up the overthrustprotector 76. In addition, the engine controller circuitry is housed ina separate housing from the overthrust protector circuitry. The fuelflow demand signal 78 which passes between the engine controller 52 andthe overthrust protector 76 is a serial digital transmission which isreceived by a suitably buffered input on the overthrust protector. Thesignal could alternatively be a parallel digital or an analogue signal.

[0056] There is thus provided a control system for an aircraft engine inwhich overthrust protection is provided both by the engine controllerand the separate overthrust protector.

[0057] Because of the independence of the engine controller and theoverthrust protector, a single failure will not result in themalfunctioning of both these systems. Both systems have overthrustprotection built into them. Thus, the malfunctioning of a single one ofthe engine controller and the overthrust protector will not result inoverthrust. This means that overthrust protection is provided fullywithin a single channel. Therefore, an aircraft could fly on a singlechannel and nevertheless have sufficient overthrust protection. Inaddition, because overthrust problems are generally dealt with by thecomparitor 92 providing an appropriate FMV demand signal, rather than byshutting off the fuel flow completely via the shut off valve, suchsituations may be dealt with more safely than was the case with theprior art system.

[0058] Various modifications may be made to the above describedembodiment without departing from the scope of the invention. Inparticular, more sophisticated implementations could incorporate thecalculation of a maximum limit for fuel flow in the overthrust protectorfor all throttle positions and also for a thrust reverser position.

[0059] Whilst endeavouring in the foregoing specification to drawattention to those features of the invention believed to be ofparticular importance it should be understood that the Applicant claimsprotection in respect of any patentable feature or combination offeatures hereinbefore referred to and/or shown in the drawings whetheror not particular emphasis has been placed thereon.

I claim:
 1. Control apparatus for an aircraft engine, the controlapparatus including: engine control means including; means for receivinga signal representative of a desired thrust for the engine; means forreceiving a signal representative of the actual thrust of the engine;and means for analysing the above signals and for producing a signalrepresentative of a desired fuel flow for the engine; and fuel controlmeans including: means for receiving a signal representing a desiredfuel flow; means for providing a signal to a fuel monitoring means forregulating the flow of fuel to the engine; means for receiving afeedback signal from the fuel monitoring means; and means for analysingthe signal representing desired fuel flow and the feedback signal fromthe fuel monitoring means and adjusting the signal to the fuelmonitoring means for achieving the desired fuel flow; wherein the enginecontrol means and the fuel control means are separately powered suchthat a failure of the power supply to one of them will not necessarilyresult in a failure of the power supply to the other.
 2. Controlapparatus according to claim 1, wherein the engine control means and thefuel control means are physically separated.
 3. Control apparatusaccording to claim 2, wherein the engine control means and the fuelcontrol means are provided within separate housings allowing limitedcommunication of data therebetween.
 4. Control apparatus according toclaim 1, further including selection means for receiving first andsecond signals each representing desired fuel flow and selecting thelower of the two.
 5. Control apparatus according to claim 4, wherein thefuel control means receives the selected lower desired fuel flow signal.6. Control apparatus according to claim 4, wherein the first signalrepresenting desired fuel flow is produced by the engine control means.7. Control apparatus according to claim 4, wherein the second signalrepresenting desired fuel flow is produced by a protector means, whichis powered separately from the engine control means.
 8. Controlapparatus according to claim 7, wherein the protector means includesmeans for receiving a signal representing engine thrust and a signalindicating whether a throttle of the aircraft is idle or in reverse andthe thrust reversers not deployed and means for calculating a maximumdesired fuel flow demand appropriate for the above conditions. 9.Control apparatus according to claim 8 wherein the signal representingengine thrust comprises a signal reprsenting engine speed.
 10. Controlapparatus according to claim 1, wherein the engine control meansincludes means for determining whether the comparative values of thesignals representing actual thrust of the engine and the desired thrustof the engine suggest overthrust and means for reducing or preventingfuel flow to the engine in such circumstances.
 11. Control apparatusaccording to claim 1, further including fuel monitoring means which maybe controlled by the signal from the fuel control means.
 12. Controlapparatus according to claim 11, wherein the fuel monitoring meanscomprises a fuel metering valve which may be adjusted by a torque motor.13. Control apparatus according to claim 12, wherein the fuel meteringvalve position controls the fuel flow to burners of the combustor of thegas turbine engine, thereby controlling the thrust of the engine.